dad24c03ff
* outposts: initial cookie domain implementation Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web/admin: add cookie domain setting Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * providers/proxy: replace forward_auth_mode with general mode Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web/admin: rebuild proxy provider form Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * providers/proxy: re-add forward_auth_mode for backwards compat Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web/admin: fix data.mode not being set Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * root: always set log level to debug when testing Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * providers/proxy: use new mode attribute Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * providers/proxy: only ingress /akprox on forward_domain Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * providers/proxy: fix lint error Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web/admin: fix error on ProxyProviderForm when not using proxy mode Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web/admin: fix default for outpost form's type missing Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web/admin: add additional desc for proxy modes Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * outposts: fix service account permissions not always being updated Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * outpost/proxy: fix redirecting to incorrect host for domain mode Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web: improve error handling for network errors Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * outpost: fix image naming not matching main imaeg Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * outposts/proxy: fix redirects for domain mode and traefik Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web: fix colour for paragraphs Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web/flows: fix consent stage not showing permissions correctly Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * website/docs: add domain-level docs Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * website/docs: fix broken links Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * outposts/proxy: remove dead code Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web/flows: fix missing id for #header-text Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
56 lines
2.2 KiB
Markdown
56 lines
2.2 KiB
Markdown
---
|
|
title: LDAP Outpost
|
|
---
|
|
|
|
:::info
|
|
This feature is still in technical preview, so please report any Bugs you run into on [GitHub](https://github.com/goauthentik/authentik/issues)
|
|
:::
|
|
|
|
You can configure an LDAP Provider for applications that don't support any newer protocols or require LDAP.
|
|
|
|
All users and groups in authentik's database are searchable. Currently, there is a limited support for filters (you can only search for objectClass), but this will be expanded in further releases.
|
|
|
|
Binding against the LDAP Server uses a flow in the background. This allows you to use the same policies and flows as you do for web-based logins. The only limitation is that currently only identification and password stages are supported, due to how LDAP works.
|
|
|
|
You can configure under which base DN the information should be available. For this documentation we'll use the default of `DC=ldap,DC=goauthentik,DC=io`.
|
|
|
|
Users are available under `ou=users,<base DN>` and groups under `ou=groups,<base DN>`.
|
|
|
|
You can bind using the DN `cn=<username>,ou=users,<base DN>`, or using the following ldapsearch command for example:
|
|
|
|
```
|
|
ldapsearch \
|
|
-x \ # Only simple binds are currently supported
|
|
-h *ip* \
|
|
-p 3389 \
|
|
-D 'cn=*user*,ou=users,DC=ldap,DC=goauthentik,DC=io' \ # Bind user and password
|
|
-w '*password*' \
|
|
-b 'ou=users,DC=ldap,DC=goauthentik,DC=io' \ # The search base
|
|
'(objectClass=user)'
|
|
```
|
|
|
|
The following fields are currently sent for users:
|
|
|
|
- `cn`: User's username
|
|
- `uid`: Unique user identifier
|
|
- `name`: User's name
|
|
- `displayName`: User's name
|
|
- `mail`: User's email address
|
|
- `objectClass`: A list of these strings:
|
|
- "user"
|
|
- "organizationalPerson"
|
|
- "goauthentik.io/ldap/user"
|
|
- `accountStatus`: "active" if the account is active, otherwise "inactive"
|
|
- `superuser`: "active" if the account is part of a group with superuser permissions, otherwise "inactive"
|
|
- `memberOf`: A list of all DNs that the user is a member of
|
|
|
|
The following fields are current set for groups:
|
|
|
|
- `cn`: The group's name
|
|
- `uid`: Unique group identifier
|
|
- `objectClass`: A list of these strings:
|
|
- "group"
|
|
- "goauthentik.io/ldap/group"
|
|
|
|
**Additionally**, for both users and groups, any attributes you set are also present as LDAP Attributes.
|